T0823 Graphical User Interface — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0772 Detection of Graphical User Interface

AN1904 Analytic 1904

Real-time monitoring identifies an interactive desktop session Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), or vendor remote console to an Human-Machine Interface (HMI) or engineering station from a source Internet Protocol (IP) addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or from an account not in the approved operator/engineer list, where the session subsequently interacts with Industrial Control System (ICS) control elements. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2144 Analytic 2144

Real-time monitoring identifies Secure Shell (SSH) sessions with X11 forwarding or Virtual Network Computing (VNC) connections to Industrial Control System (ICS) Linux hosts from unexpected source Internet Protocol (IP) addresses, combined with X11 application launches from the session. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2197 Analytic 2197

Real-time monitoring identifies remote console or web management sessions to Industrial Control System (ICS) network devices from IP addresses that are not approved Network Management System (NMS) hosts, where the sessions access device configuration interfaces. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

AN2251 Analytic 2251

Real-time monitoring identifies Virtual Network Computing (VNC) or proprietary remote console sessions to embedded Human-Machine Interface (HMI) panels or operator terminals from IP addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, where the sessions access Industrial Control System (ICS) control interfaces with physical-plant impact. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.